[4274] in Privacy_Forum
[ PRIVACY Forum ] No easy way to stop BREACH from plucking secrets
daemon@ATHENA.MIT.EDU (PRIVACY Forum mailing list)
Fri Aug 2 14:50:39 2013
Date: Fri, 2 Aug 2013 11:34:06 -0700
To: privacy-list@vortex.com
Message-ID: <20130802183406.GB29405@vortex.com>
MIME-Version: 1.0
Content-Disposition: inline
From: PRIVACY Forum mailing list <privacy@vortex.com>
Reply-To: PRIVACY Forum mailing list <privacy@vortex.com>
Content-Type: text/plain; charset="iso-8859-1"
Errors-To: privacy-bounces+privacy-forum=mit.edu@vortex.com
Content-Transfer-Encoding: 8bit
No easy way to stop BREACH from plucking secrets from HTTPS pages, feds say
http://j.mp/19CjiCc (ars technica)
"Less than 24 hours after researchers disclosed a new attack that can
pluck secrets from webpages protected by the widely used HTTPS
encryption scheme, the US Department of Homeland Security is advising
website operators to investigate whether they're susceptible. As Ars
reported Thursday, an exploit dubbed BREACH-short for Browser
Reconnaissance and Exfiltration via Adaptive Compression of
Hypertext-can decode e-mail addresses, certain types of security
tokens, and other secrets from encrypted webpages, often in as little
as 30 seconds."
- - -
--Lauren--
Lauren Weinstein (lauren@vortex.com): http://www.vortex.com/lauren
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
privacy mailing list
http://lists.vortex.com/mailman/listinfo/privacy
